Webpros vulnerabilities

Products

• Cpanel 20
• Plesk 14
• Wp Squared 14
• Cpanel (cloudlinux 6, Centos 6) 5
• Configserver Security & Firewall 3
• Whmcs 3
• Comet Backup 2

Newest

• webpros cpanel Improper link resolution before file access in cPanel allows remote authenticated users to write... CVE-2026-105476 8.8 HighNovember 2, 2026
• webpros cpanel Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account... CVE-2026-105475 8.7 HighNovember 2, 2026
• webpros solusvm 2 A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote... CVE-2026-105474 9.4 CriticalOctober 15, 2026
• webpros wp toolkit Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other... CVE-2026-93699 8.5 HighOctober 8, 2026
• webpros cpanel, wp squared +1 more There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts... CVE-2026-93029 9.0 CriticalOctober 2, 2026
• webpros cpanel, wp squared +1 more There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify... CVE-2026-93697 9.0 CriticalOctober 2, 2026
• webpros cpanel, wp squared +1 more Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin. CVE-2026-93698 9.9 CriticalOctober 2, 2026
• webpros wp toolkit for cpanel Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated... CVE-2026-87900 9.4 CriticalSeptember 23, 2026
• webpros cpanel Execution with unnecessary privileges in cPanel allows remote authenticated users to execute... CVE-2026-87899 9.4 CriticalSeptember 23, 2026
• webpros plesk extension "site import" OS command injection in Plesk allows remote authenticated users to execute arbitrary code with... CVE-2026-87898 9.4 CriticalSeptember 23, 2026
• plesk, webpros plesk extension "plesk restful api" +1 more An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before... CVE-2026-68492 8.7 HighSeptember 23, 2026
• webpros cpanel Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information... CVE-2026-68490 8.2 HighSeptember 23, 2026
• webpros solusvm An insufficient check allowed for the overwrite of arbitrary files via a symlink. CVE-2026-68491 9.4 CriticalSeptember 15, 2026
• webpros plesk extension "node.js toolkit", plesk extension "ruby" +1 more Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0... CVE-2026-68489 8.7 HighSeptember 14, 2026
• webpros whmcs Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows... CVE-2026-67399 9.3 CriticalSeptember 14, 2026
• plesk A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in... CVE-2026-68488 9.9 CriticalSeptember 10, 2026
• plesk Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated... CVE-2026-68487 9.9 CriticalSeptember 10, 2026
• configserver security & firewall, webpros configserver security & firewall +1 more OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a... CVE-2026-65639 9.5 CriticalSeptember 10, 2026
• configserver security & firewall, webpros configserver security & firewall +1 more Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated... CVE-2026-65638 9.2 CriticalSeptember 10, 2026
• webpros cpanel A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root... CVE-2026-67401 Public exploit 9.9 CriticalSeptember 9, 2026
• configserver security & firewall, webpros configserver security & firewall +1 more An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI... CVE-2026-67402 9.2 CriticalSeptember 3, 2026
• webpros whmcs Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS... CVE-2026-67398 8.2 HighSeptember 3, 2026
• plesk Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to... CVE-2026-67397 8.5 HighSeptember 3, 2026
• plesk A critical local privilege escalation via OS command injection vulnerability has been discovered... CVE-2026-67394 9.0 CriticalSeptember 1, 2026
• cpanel Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute... CVE-2026-65643 Public exploit 8.7 HighSeptember 1, 2026
• webpros plesk migrator, plesk site import +1 more Improper symlink resolution before file access in Plesk allows remote authenticated users to... CVE-2026-65647 Public exploit 8.7 HighAugust 26, 2026
• plesk Improper neutralization of special elements in Plesk allows remote authenticated users to... CVE-2026-65646 9.9 CriticalAugust 26, 2026
• plesk Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3,... CVE-2026-65642 8.6 HighAugust 26, 2026
• plesk Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a... CVE-2026-64639 9.3 CriticalAugust 12, 2026
• plesk Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated... CVE-2026-64637 9.9 CriticalAugust 7, 2026
• plesk An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an... CVE-2026-64636 7.7 HighAugust 7, 2026
• webpros cpanel, wp squared +1 more Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in... CVE-2026-58048 Public exploit 9.4 CriticalJuly 31, 2026
• webpros cpanel, wp squared +1 more HTTP Smuggling in cPanel allows potential leak of credentials. CVE-2026-58047 5.6 MediumJuly 31, 2026
• plesk Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged... CVE-2026-58046 9.9 CriticalJuly 30, 2026
• plesk Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low... CVE-2026-56843 9.9 CriticalJuly 8, 2026
• plesk An improper authorization vulnerability in the Plesk XML API allows an authenticated user to... CVE-2026-48614 9.9 CriticalJuly 6, 2026
• webpros wordpress-toolkit Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM,... CVE-2026-47365 9.9 CriticalJune 12, 2026
• plesk Plesk contains an XPath injection vulnerability in the APS Application Catalog search... CVE-2026-44962 9.9 CriticalMay 29, 2026
• webpros comet backup Insufficient character filtering in backup agent signing module on Comet Backup server allows... CVE-2026-32999 9.1 CriticalMay 28, 2026
• webpros cpanel, cpanel (cloudlinux 6, centos 6), wp squared +2 more Improper authorization checks of team members privileges allow a team member to escalate... CVE-2026-32991 7.1 HighMay 13, 2026
• webpros cpanel, cpanel (cloudlinux 6, centos 6), wp squared +2 more Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL... CVE-2026-29206 8.1 HighMay 13, 2026
• webpros cpanel, wp squared +1 more Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint... CVE-2026-32993 8.3 HighMay 13, 2026
• cpanel, cpanel whm, wp squared +2 more SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server... CVE-2026-32992 8.2 HighMay 13, 2026
• cpanel, cpanel whm, wp squared +2 more Incorrect privileges management and insufficient path filtering allow to read arbitrary file on... CVE-2026-29205 8.6 HighMay 13, 2026
• webpros whmcs Insufficient ownership checks in `clientarea.php` allow an authenticated client area user to... CVE-2026-29204 Public exploit 9.1 CriticalMay 12, 2026
• webpros cpanel, cpanel (cloudlinux 6, centos 6), wp squared +2 more A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing... CVE-2026-29203 5.3 MediumMay 8, 2026
• webpros cpanel, cpanel (cloudlinux 6, centos 6), wp squared +2 more Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows... CVE-2026-29202 5.3 MediumMay 8, 2026
• webpros cpanel, cpanel (cloudlinux 6, centos 6), wp squared +2 more Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin... CVE-2026-29201 8.6 HighMay 8, 2026
• webpros comet backup A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20... CVE-2026-29200 9.9 CriticalMay 4, 2026
• cpanel, cpanel whm, wp squared +1 more +3 more WebPros cPanel and WHM Authentication Bypass via Login Flow CVE-2026-41940 In KEVPublic exploit EPSS 98.5% 9.3 CriticalApril 29, 2026
• Show olderLoading…